Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

ait-core

6 known vulnerabilities (2 critical, 4 high), with the versions each affects and the releases that fix them.

Latest release
3.1.2 (Sep 22, 2026): no advisory affects it
Newest unaffected release
3.1.2 (Sep 22, 2026), the latest release
Advisories
6 · 2 critical, 4 high
Weekly downloads
962
Dependents
1
Releases
24 since 1.1.0
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2026-47731Critical 9.1

    NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated…

    Affected: fixed in 2.6.1; from 3.1.0, fixed in 3.1.1; from 3.1.0, fixed in 3.1.1; fixed in 2.6.1.

    Fixed in 2.6.1 (released May 28, 2026, 54 days before disclosure) and 3.1.1 (released May 28, 2026, 54 days before disclosure).

    The latest release, 3.1.2, is not affected.

  • NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a…

    Affected: through 2.5.2.

    Fixed in 2.6.0 (released May 18, 2026, 727 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.1.2, is not affected.

  • An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.

    Affected: through 2.5.2.

    Fixed in 2.6.0 (released May 18, 2026, 727 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.1.2, is not affected.

  • An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.

    Affected: through 2.5.2.

    Fixed in 2.6.0 (released May 18, 2026, 727 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.1.2, is not affected.

  • An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet.

    Affected: through 2.5.2.

    Fixed in 2.6.0 (released May 18, 2026, 727 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.1.2, is not affected.

  • CVE-2024-35056Critical 9.8

    NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.

    Affected: through 2.5.2.

    Fixed in 2.6.0 (released May 18, 2026, 727 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.1.2, is not affected.